SB20261111115 - Multiple vulnerabilities in Aspire.Cli

Description

This security bulletin contains information about 2 vulnerabilities.

1) Creation of temporary file in directory with insecure permissions (CVE-ID: CVE-2026-120778)

CWE-ID: CWE-379 - Creation of Temporary File in Directory with Insecure Permissions

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges and execute code with another user's permissions on the affected system.

The vulnerability exists due to creation of temporary files in a directory with insecure permissions in .NET Aspire's Aspire.Cli when handling temporary files. A local user can exploit this insecure temporary-file handling, with user interaction, to execute code with another user's permissions and access data and resources available to that user.

2) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-120792)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose another user's configuration information, including credentials stored in that configuration.

The vulnerability exists due to insertion of sensitive information into log files in .NET Aspire's diagnostic logging when recording configuration information. A local user can read exposed diagnostic logs on a shared computer to obtain another user's configuration information and stored credentials.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-120778
• https://github.com/microsoft/aspire/releases/tag/v13.6.5
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-120792